MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db866e4abbc254e0537067e6195d1efb1da8bd3aa317bc5e9397f8647e0fb836. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	db866e4abbc254e0537067e6195d1efb1da8bd3aa317bc5e9397f8647e0fb836
SHA3-384 hash:	445be567c20028641209cdd5a31a8d33264fea38849e99b2a59255717efc44def3711216e72327c549e5e3de692960d3
SHA1 hash:	b1602317da9b7ea8ac70106108b12f53c80c98d3
MD5 hash:	1247687aa0981ea95c6806b25deec931
humanhash:	purple-alaska-indigo-island
File name:	tftp.sh
Download:	download sample
File size:	623 bytes
First seen:	2025-02-19 16:26:49 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	6:LjKUi1E6VjKUifNy49tX1VjKUiGBVjKUiTLQVjKUiUhFjVjKUiwKpAIx8:SUY8US9tF8Ur8U4M8U7j8Uyi
TLSH	T1BAF0A9C963B3773189C8209DE60716B6B17FD0E8571B1EC55AB472F4C2DC9115A91644
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

85

Origin country :

DE

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67b6073128ab76d43a5bef03linux22vpnfull_triage

Tags:

malware

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

busybox

Link:

https://www.filescan.io/uploads/67b608932b2cb326fc9fed22/reports/e36e6c04-2622-4ea0-b8c8-e8d9200a483b/overview

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/db866e4abbc254e0537067e6195d1efb1da8bd3aa317bc5e9397f8647e0fb836

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/db866e4abbc254e0537067e6195d1efb1da8bd3aa317bc5e9397f8647e0fb836/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3odg4sv3yjkoau3qm7tbsxi67mo2rpj2uml3yxuts74gi7qpxa3a._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

discovery

Link:

https://tria.ge/reports/250219-tycvvsvkfl/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/db866e4abbc254e0537067e6195d1efb1da8bd3aa317bc5e9397f8647e0fb836